Top Risks

• THREAT FEED: extension ID independently confirmed malicious by TPCI chrome-mal-ids — Rick And Morty Cosmic Portal Scene Live Wallpaper [adware] + malext.io malicious_extension_sentry (+2.5, capped).
• Newtab override: replaces every new tab with wallpaper/search surface — classic monetization shell pattern.
• Uninstall and install URL hijacks redirect to developer marketing page with UTM tracking.
• Privacy policy URL returns HTTP error (fetch failed); policy cannot be verified — scored as no policy.
• No developer name listed; 22 sibling extensions under same dev email indicate operator cluster.

Evidence

• newtab_override manifest chrome_url_overrides.newtab set to newtab.html — hijacks every new tab.
• uninstall_url_hijack crx setUninstallURL targets https://gameograf.com/?p=34618?utm_source=extension&utm_medium=uninstall
• install_url_hijack crx onInstalled opens https://gameograf.com/?p=34618?utm_source=extension&utm_medium=install
• privacy_policy_fetch_failed api privacy_policy_classification.fetched==false; HTTPError — policy unverifiable, scored as absent.
• operator_cluster_dev_email api dev_email dimension shows 22 sibling extensions under support@gameograf.com.
• no_developer_name store developer_name is empty string in listing.
• dom_xss_sink_no_csp crx innerHTML user-controlled sink in calendar.js; csp_present==false on MV3.
• verified_publisher store Extension carries verified_publisher=true; partial reputation credit applied.
• threat_feed_membership api Extension ID listed by TPCI chrome-mal-ids — Rick And Morty Cosmic Portal Scene Live Wallpaper [adware] + malext.io malicious_extension_sentry; score 5.12 -> 7.62 (+2.5 cap 2.5).

Permissions Breakdown

• search medium Allows querying browser search engine; medium risk when combined with newtab override.
• alarms low Schedules callbacks; low risk in isolation.
• storage low Local extension storage; low risk.
• host_permissions: https://api.gameograf.com/* medium Scoped to developer API; allows data exfil to own server.
• chrome_url_overrides.newtab medium Replaces every new tab; high-reach surface for search monetization.

Pillar Scores

Bookkeeping